Deployed 5228734 to edge with MkDocs 1.6.1 and mike 2.1.3

edge/404.html

@@ -19,7 +19,7 @@
       
       
       <link rel="icon" href="/wg-easy/edge/assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/advanced/api/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/advanced/config/amnezia/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/advanced/config/experimental-config/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/advanced/config/optional-config/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/advanced/config/unattended-setup/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/advanced/metrics/prometheus/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/advanced/migrate/from-14-to-15/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/advanced/migrate/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/contributing/general/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/contributing/issues-and-pull-requests/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/contributing/translation/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/examples/tutorials/adguard/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/examples/tutorials/auto-updates/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/examples/tutorials/basic-installation/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/examples/tutorials/caddy/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/examples/tutorials/docker-run/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/examples/tutorials/dockerless/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/examples/tutorials/podman-nft/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/examples/tutorials/reverse-proxyless/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/examples/tutorials/routed/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/examples/tutorials/traefik/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/faq/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       
@@ -80,7 +80,7 @@
     <div data-md-component="skip">
       
         
-        <a href="#error-wireguard-exited-with-the-error-cannot-find-device-wg0" class="md-skip">
+        <a href="#how-do-i-restrict-client-access-to-specific-networks-or-servers" class="md-skip">
           Skip to content
         </a>
       
@@ -506,6 +506,17 @@
     </label>
     <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
       
+        <li class="md-nav__item">
+  <a href="#how-do-i-restrict-client-access-to-specific-networks-or-servers" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        How do I restrict client access to specific networks or servers?
+      
+    </span>
+  </a>
+  
+</li>
+      
         <li class="md-nav__item">
   <a href="#error-wireguard-exited-with-the-error-cannot-find-device-wg0" class="md-nav__link">
     <span class="md-ellipsis">
@@ -1826,6 +1837,17 @@
     </label>
     <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
       
+        <li class="md-nav__item">
+  <a href="#how-do-i-restrict-client-access-to-specific-networks-or-servers" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        How do I restrict client access to specific networks or servers?
+      
+    </span>
+  </a>
+  
+</li>
+      
         <li class="md-nav__item">
   <a href="#error-wireguard-exited-with-the-error-cannot-find-device-wg0" class="md-nav__link">
     <span class="md-ellipsis">
@@ -1919,6 +1941,16 @@
   <h1>FAQ</h1>
 
 <p>Here are some frequently asked questions or errors about <code>wg-easy</code>. If you have a question that is not answered here, please feel free to open a discussion on GitHub.</p>
+<h2 id="how-do-i-restrict-client-access-to-specific-networks-or-servers"><a class="toclink" href="#how-do-i-restrict-client-access-to-specific-networks-or-servers">How do I restrict client access to specific networks or servers?</a></h2>
+<p>Use the <strong>Per-Client Firewall</strong> feature to enforce server-side restrictions on what each client can access.</p>
+<p><strong>Requirements:</strong> This feature requires <code>iptables</code> (and <code>ip6tables</code> for IPv6) to be installed on the host system.</p>
+<ol>
+<li>Enable "Per-Client Firewall" in <strong>Admin Panel → Interface</strong></li>
+<li>Edit a client and configure "Firewall Allowed IPs"</li>
+<li>Specify which destinations the client should be allowed to access</li>
+</ol>
+<p>Unlike "Allowed IPs" which only controls client-side routing, firewall rules are enforced by the server and cannot be bypassed.</p>
+<p>See the <a href="guides/admin/#per-client-firewall">Admin Panel Guide</a> and <a href="guides/clients/#firewall-allowed-ips">Client Guide</a> for detailed configuration.</p>
 <h2 id="error-wireguard-exited-with-the-error-cannot-find-device-wg0"><a class="toclink" href="#error-wireguard-exited-with-the-error-cannot-find-device-wg0">Error: WireGuard exited with the error: Cannot find device "wg0"</a></h2>
 <p>This error indicates that the WireGuard interface <code>wg0</code> does not exist. This can happen if the WireGuard kernel module is not loaded or if the interface was not created properly.</p>
 <p>To resolve this issue, you can try the following steps:</p>

edge/getting-started/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/guides/2fa/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/guides/admin/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       
@@ -79,6 +79,11 @@
     <label class="md-overlay" for="__drawer"></label>
     <div data-md-component="skip">
       
+        
+        <a href="#interface-settings" class="md-skip">
+          Skip to content
+        </a>
+      
     </div>
     <div data-md-component="announce">
       
@@ -1593,6 +1598,24 @@
       
       
       
+        <label class="md-nav__link md-nav__link--active" for="__toc">
+          
+  
+  
+  <span class="md-ellipsis">
+    
+  
+    Admin Panel
+  
+
+    
+  </span>
+  
+  
+
+          <span class="md-nav__icon md-icon"></span>
+        </label>
+      
       <a href="./" class="md-nav__link md-nav__link--active">
         
   
@@ -1610,6 +1633,51 @@
 
       </a>
       
+        
+
+<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
+  
+  
+  
+  
+    <label class="md-nav__title" for="__toc">
+      <span class="md-nav__icon md-icon"></span>
+      Table of contents
+    </label>
+    <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
+      
+        <li class="md-nav__item">
+  <a href="#interface-settings" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Interface Settings
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="Interface Settings">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#per-client-firewall" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Per-Client Firewall
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
+</li>
+      
+    </ul>
+  
+</nav>
+      
     </li>
   
 
@@ -1724,6 +1792,42 @@
   
   
   
+    <label class="md-nav__title" for="__toc">
+      <span class="md-nav__icon md-icon"></span>
+      Table of contents
+    </label>
+    <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
+      
+        <li class="md-nav__item">
+  <a href="#interface-settings" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Interface Settings
+      
+    </span>
+  </a>
+  
+    <nav class="md-nav" aria-label="Interface Settings">
+      <ul class="md-nav__list">
+        
+          <li class="md-nav__item">
+  <a href="#per-client-firewall" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Per-Client Firewall
+      
+    </span>
+  </a>
+  
+</li>
+        
+      </ul>
+    </nav>
+  
+</li>
+      
+    </ul>
+  
 </nav>
                   </div>
                 </div>
@@ -1757,7 +1861,39 @@
 
   <h1>Admin Panel</h1>
 
-<p>TODO</p>
+<h2 id="interface-settings"><a class="toclink" href="#interface-settings">Interface Settings</a></h2>
+<h3 id="per-client-firewall"><a class="toclink" href="#per-client-firewall">Per-Client Firewall</a></h3>
+<p>Enable server-side firewall filtering to enforce network access restrictions per client.</p>
+<p>When enabled, each client can have custom "Firewall Allowed IPs" configured that restrict which destinations they can access through the VPN. These restrictions are enforced by the server using iptables/ip6tables and cannot be bypassed by the client.</p>
+<div class="admonition warning">
+<p class="admonition-title">Experimental Feature</p>
+<p>This feature is currently experimental. While functional, it should be thoroughly tested in your environment before relying on it for production security requirements. Always verify that firewall rules are working as expected using test traffic or by manually inspecting the rules.</p>
+</div>
+<p><strong>Requirements:</strong></p>
+<ul>
+<li><code>iptables</code> must be installed on the host system</li>
+<li><code>ip6tables</code> must be installed if IPv6 is enabled (default)</li>
+<li>The feature cannot be enabled if these tools are not available</li>
+</ul>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>Most Linux distributions include iptables by default. If you're running in a minimal container environment, you may need to install the <code>iptables</code> package on the host system.</p>
+</div>
+<p><strong>Enable this feature if you want to:</strong></p>
+<ul>
+<li>Restrict certain clients to only access specific servers or networks</li>
+<li>Prevent clients from accessing the internet while allowing LAN access</li>
+<li>Enforce port-based restrictions (e.g., only allow HTTP/HTTPS)</li>
+<li>Separate routing configuration from security enforcement</li>
+</ul>
+<p><strong>How it works:</strong></p>
+<ol>
+<li>Enable "Per-Client Firewall" in Admin Panel → Interface</li>
+<li>Edit any client to see the new "Firewall Allowed IPs" field</li>
+<li>Specify allowed destinations (IPs, subnets, ports) for that client</li>
+<li>Server enforces these rules automatically</li>
+</ol>
+<p>See <a href="../clients/#firewall-allowed-ips">Edit Client → Firewall Allowed IPs</a> for detailed configuration syntax and examples.</p>
 
 
 

edge/guides/cli/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       
@@ -1733,6 +1733,28 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#show-clients" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Show Clients
+      
+    </span>
+  </a>
+  
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#show-client-qr-code" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Show Client QR Code
+      
+    </span>
+  </a>
+  
 </li>
       
     </ul>
@@ -1890,6 +1912,28 @@
       </ul>
     </nav>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#show-clients" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Show Clients
+      
+    </span>
+  </a>
+  
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#show-client-qr-code" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Show Client QR Code
+      
+    </span>
+  </a>
+  
 </li>
       
     </ul>
@@ -1950,6 +1994,21 @@ docker<span class="w"> </span>compose<span class="w"> </span><span class="nb">ex
 docker<span class="w"> </span>compose<span class="w"> </span><span class="nb">exec</span><span class="w"> </span>-it<span class="w"> </span>wg-easy<span class="w"> </span>cli<span class="w"> </span>db:admin:reset<span class="w"> </span>--password<span class="w"> </span>&lt;new_password&gt;
 </code></pre></div>
 <p>This will reset the password for the admin user to the new password you provided. If you include special characters in the password, make sure to escape them properly.</p>
+<h3 id="show-clients"><a class="toclink" href="#show-clients">Show Clients</a></h3>
+<p>List all clients that are currently configured with details such as client ID, Name, Public Key, and enabled status.</p>
+<div class="highlight"><pre><span></span><code>cli<span class="w"> </span>clients:list
+</code></pre></div>
+<h3 id="show-client-qr-code"><a class="toclink" href="#show-client-qr-code">Show Client QR Code</a></h3>
+<p>Display the QR code for a specific client, which can be scanned by a compatible app to import the client's configuration.</p>
+<div class="highlight"><pre><span></span><code>cli<span class="w"> </span>clients:qr<span class="w"> </span>&lt;client_id&gt;
+</code></pre></div>
+<p>Replace <code>&lt;client_id&gt;</code> with the actual client ID you want to show the QR code for.</p>
+<div class="admonition warning">
+<p class="admonition-title">IPv6 Support</p>
+<p>IPv6 support is enabled by default, even if you disabled it using environment variables. To disable it pass the <code>--no-ipv6</code> flag when running the CLI.</p>
+<div class="highlight"><pre><span></span><code>cli<span class="w"> </span>clients:qr<span class="w"> </span>&lt;client_id&gt;<span class="w"> </span>--no-ipv6
+</code></pre></div>
+</div>
 
 
 

edge/guides/clients/index.html

@@ -25,7 +25,7 @@
       
       
       <link rel="icon" href="../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       
@@ -1733,6 +1733,17 @@
     </span>
   </a>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#firewall-allowed-ips" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Firewall Allowed IPs
+      
+    </span>
+  </a>
+  
 </li>
       
         <li class="md-nav__item">
@@ -1889,6 +1900,17 @@
     </span>
   </a>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#firewall-allowed-ips" class="md-nav__link">
+    <span class="md-ellipsis">
+      
+        Firewall Allowed IPs
+      
+    </span>
+  </a>
+  
 </li>
       
         <li class="md-nav__item">
@@ -1995,7 +2017,52 @@
 <h2 id="allowed-ips"><a class="toclink" href="#allowed-ips">Allowed IPs</a></h2>
 <p>Which IPs will be routed through the VPN.</p>
 <p>This will not prevent the user from modifying it locally and accessing IP ranges that they should not be able to access.</p>
-<p>Use firewall rules to prevent access to IP ranges that the user should not be able to access.</p>
+<p>Use the Firewall Allowed IPs feature to prevent access to IP ranges that the user should not be able to access.</p>
+<h2 id="firewall-allowed-ips"><a class="toclink" href="#firewall-allowed-ips">Firewall Allowed IPs</a></h2>
+<div class="admonition note">
+<p class="admonition-title">Attention</p>
+<p>This field only appears when <strong>Per-Client Firewall</strong> is enabled in the Admin Panel → Interface settings.</p>
+</div>
+<p>Server-side firewall rules that restrict which destinations the client can access, regardless of their local configuration.</p>
+<p>Unlike "Allowed IPs" which only controls routing on the client side, these rules are enforced by the server using iptables/ip6tables and cannot be bypassed by the client.</p>
+<p><strong>Supported Formats:</strong></p>
+<ul>
+<li><code>10.10.0.3</code>, <code>2001:db8::1</code> - Allow access to a single IP address</li>
+<li><code>10.10.0.0/24</code>, <code>2001:db8::/32</code> - Allow access to an entire subnet</li>
+<li><code>192.168.1.5:443</code> - Allow access to specific port (TCP+UDP)</li>
+<li><code>192.168.1.5:443/tcp</code> - Allow access to specific port (TCP only)</li>
+<li><code>192.168.1.5:443/udp</code> - Allow access to specific port (UDP only)</li>
+<li><code>10.10.0.0/24:443</code> - Allow access to an entire subnet on a specific port (TCP+UDP)</li>
+<li><code>10.10.0.0/24:443/tcp</code> - Allow access to an entire subnet on a specific port (TCP only)</li>
+<li><code>10.10.0.0/24:443/udp</code> - Allow access to an entire subnet on a specific port (UDP only)</li>
+<li><code>[2001:db8::1]:443</code> - IPv6 address with port (brackets required)</li>
+<li><code>[2001:db8::/32]:443/tcp</code> - IPv6 CIDR with port and protocol</li>
+</ul>
+<div class="admonition warning">
+<p class="admonition-title">Invalid Formats</p>
+<p>Protocol specifiers (<code>/tcp</code> or <code>/udp</code>) require a port number. The following formats are <strong>not supported</strong> and will result in an error:</p>
+<ul>
+<li><code>10.10.0.3/tcp</code> (use <code>10.10.0.3:443/tcp</code> instead)</li>
+<li><code>10.10.0.0/24/udp</code> (use <code>10.10.0.0/24:53/udp</code> instead)</li>
+</ul>
+</div>
+<p><strong>Behavior:</strong></p>
+<ul>
+<li><strong>Empty</strong>: Falls back to the client's "Allowed IPs" setting</li>
+<li><strong>Specified</strong>: Only listed destinations are accessible (allow-only, everything else is blocked)</li>
+<li><strong>Disable for specific client</strong>: To disable firewall filtering for a single client while keeping it enabled for others, add <code>0.0.0.0/0, ::/0</code> to allow all traffic</li>
+</ul>
+<div class="admonition note">
+<p class="admonition-title">Note</p>
+<p>To allow clients to reach the VPN server itself (e.g. for DNS), include the server's VPN address in the firewall allowed IPs.</p>
+</div>
+<p><strong>Use Case Examples</strong>:</p>
+<ul>
+<li>Allow only specific servers: <code>10.10.0.5</code></li>
+<li>Allow only internal network: <code>10.10.0.0/24, 192.168.1.0/24</code></li>
+<li>Allow only web browsing: <code>0.0.0.0/0:80, 0.0.0.0/0:443, [::/0]:80, [::/0]:443</code></li>
+<li>Block internet, allow LAN: Leave "Allowed IPs" as <code>0.0.0.0/0, ::/0</code> but set Firewall IPs to <code>10.0.0.0/8, 192.168.0.0/16</code></li>
+</ul>
 <h2 id="server-allowed-ips"><a class="toclink" href="#server-allowed-ips">Server Allowed IPs</a></h2>
 <p>Which IPs will be routed to the client.</p>
 <h2 id="dns"><a class="toclink" href="#dns">DNS</a></h2>

edge/guides/setup/index.html

@@ -23,7 +23,7 @@
       
       
       <link rel="icon" href="../../assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/index.html

@@ -23,7 +23,7 @@
       
       
       <link rel="icon" href="assets/logo/favicon.png">
-      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.3">
+      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
     
     
       

edge/sitemap.xml

@@ -2,118 +2,118 @@
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/faq/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/getting-started/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/advanced/api/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/advanced/config/amnezia/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/advanced/config/experimental-config/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/advanced/config/optional-config/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/advanced/config/unattended-setup/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/advanced/metrics/prometheus/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/advanced/migrate/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/advanced/migrate/from-14-to-15/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/contributing/general/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/contributing/issues-and-pull-requests/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/contributing/translation/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/examples/tutorials/adguard/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/examples/tutorials/auto-updates/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/examples/tutorials/basic-installation/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/examples/tutorials/caddy/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/examples/tutorials/docker-run/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/examples/tutorials/dockerless/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/examples/tutorials/podman-nft/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/examples/tutorials/reverse-proxyless/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/examples/tutorials/routed/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/examples/tutorials/traefik/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/guides/2fa/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/guides/admin/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/guides/cli/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/guides/clients/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
     <url>
          <loc>https://wg-easy.github.io/wg-easy/edge/guides/setup/</loc>
-         <lastmod>2026-03-03</lastmod>
+         <lastmod>2026-03-05</lastmod>
     </url>
 </urlset>